ISO 27001 Compliance

DocLD provides security features aligned with ISO 27001 Information Security Management System (ISMS) requirements. See also GDPR, HIPAA, and the Overview Security & Compliance section.

Overview

ISO 27001 is an international standard for information security management. DocLD’s security features help organizations meet these requirements through:

• Security event logging - Comprehensive security event tracking
• Incident management - Security incident detection and response
• Access reviews - Periodic access control reviews
• Security metrics - Aggregated security reporting

Security Events

Event Types

DocLD logs security-relevant events:

Event Structure

{
  "id": "uuid",
  "event_type": "auth_failure",
  "actor_id": "user-uuid",
  "actor_type": "user",
  "resource_type": "session",
  "resource_id": null,
  "outcome": "failure",
  "ip_address": "192.168.1.1",
  "user_agent": "Mozilla/5.0...",
  "metadata": {
    "reason": "Invalid password",
    "attempts": 3
  },
  "created_at": "2024-01-15T10:00:00Z"
}

Viewing Events

Access security events:

• Settings → Security → Events
• API: GET /api/security/metrics

Incident Management

Incident Detection

DocLD automatically detects security incidents:

Incident Structure

{
  "id": "uuid",
  "detected_at": "2024-01-15T10:00:00Z",
  "type": "repeated_auth_failure",
  "severity": "medium",
  "summary": "User account experienced 5 failed login attempts",
  "status": "open",
  "metadata": {
    "user_id": "user-uuid",
    "ip_addresses": ["192.168.1.1", "192.168.1.2"],
    "attempt_count": 5
  }
}

Incident Severity

Incident Status

Managing Incidents

# List incidents
curl -X GET "/api/security/incidents?status=open" \
  -H "Authorization: Bearer YOUR_API_KEY"
 
# Update incident status
curl -X PATCH "/api/security/incidents/{id}" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"status": "investigating"}'

Access Reviews

Purpose

Periodic access reviews ensure:

• Users have appropriate access
• Unused accounts are identified
• API keys are still needed
• Permissions are current

Access Review API

curl -X GET "/api/security/access-review?format=json" \
  -H "Authorization: Bearer YOUR_API_KEY"

Review Contents

The access review includes:

• All API keys and their usage
• Last access timestamps
• Permission levels
• Organization memberships

Review Format

{
  "api_keys": [
    {
      "id": "key-uuid",
      "name": "Production API",
      "created_at": "2024-01-01T00:00:00Z",
      "last_used_at": "2024-01-15T10:00:00Z",
      "total_requests": 5000,
      "is_active": true,
      "expires_at": null
    }
  ],
  "generated_at": "2024-01-15T12:00:00Z"
}

Security Metrics

Aggregated Metrics

curl -X GET "/api/security/metrics?from=2024-01-01&to=2024-01-31" \
  -H "Authorization: Bearer YOUR_API_KEY"

Response

{
  "period": {
    "from": "2024-01-01T00:00:00Z",
    "to": "2024-01-31T23:59:59Z"
  },
  "metrics": {
    "auth_failures": 25,
    "auth_lockouts": 2,
    "access_denied": 10,
    "api_keys_created": 5,
    "api_keys_revoked": 2,
    "privileged_actions": 15
  },
  "incidents": {
    "total": 3,
    "by_severity": {
      "critical": 0,
      "high": 1,
      "medium": 2,
      "low": 0
    },
    "by_status": {
      "open": 1,
      "resolved": 2
    }
  }
}

Control Mapping

A.9 Access Control

A.12 Operations Security

A.16 Incident Management

A.18 Compliance

Best Practices

Access Management

1. Principle of least privilege - Grant minimum necessary access
2. Regular reviews - Conduct quarterly access reviews
3. Prompt revocation - Remove access immediately when not needed
4. MFA enforcement - Enable multi-factor authentication

Monitoring

1. Review logs daily - Check security events
2. Set up alerts - Configure incident notifications
3. Track metrics - Monitor security trends
4. Document incidents - Keep incident records

Documentation

1. Maintain policies - Keep security policies current
2. Document procedures - Write incident response procedures
3. Track changes - Log configuration changes
4. Audit trail - Preserve audit logs

Technical Controls

DocLD implements: